### Home Classes Methods

### In Files

- lib/packetfu/pcap.rb

### Parent

Array

### Methods

- ::new
- #force_binary
- #read
- #to_s

### Included Modules

- StructFu

### Files

- .document
- README.rdoc

### Class/Module Index

Quicksearch

- PacketFu
- PacketFu::ARPHeader
- PacketFu::ARPHeaderMixin
- PacketFu::ARPPacket
- PacketFu::AddrIpv6
- PacketFu::Capture
- PacketFu::Config
- PacketFu::EthHeader
- PacketFu::EthHeaderMixin
- PacketFu::EthMac
- PacketFu::EthNic
- PacketFu::EthOui
- PacketFu::EthPacket
- PacketFu::HSRPHeader
- PacketFu::HSRPHeaderMixin
- PacketFu::HSRPPacket
- PacketFu::ICMPHeader
- PacketFu::ICMPHeaderMixin
- PacketFu::ICMPPacket
- PacketFu::IPHeader
- PacketFu::IPHeaderMixin
- PacketFu::IPPacket
- PacketFu::IPv6Header
- PacketFu::IPv6HeaderMixin
- PacketFu::IPv6Packet
- PacketFu::Inject
- PacketFu::InvalidHeader
- PacketFu::InvalidPacket
- PacketFu::LLDPHeader
- PacketFu::LLDPHeaderMixin
- PacketFu::LLDPPacket
- PacketFu::Octets
- PacketFu::Packet
- PacketFu::PcapFile
- PacketFu::PcapHeader
- PacketFu::PcapPacket
- PacketFu::PcapPackets
- PacketFu::Read
- PacketFu::TCPHeader
- PacketFu::TCPHeaderMixin
- PacketFu::TCPPacket
- PacketFu::TcpEcn
- PacketFu::TcpFlags
- PacketFu::TcpHlen
- PacketFu::TcpOption
- PacketFu::TcpOption::ECHO
- PacketFu::TcpOption::ECHOREPLY
- PacketFu::TcpOption::EOL
- PacketFu::TcpOption::MSS
- PacketFu::TcpOption::NOP
- PacketFu::TcpOption::SACK
- PacketFu::TcpOption::SACKOK
- PacketFu::TcpOption::TS
- PacketFu::TcpOption::WS
- PacketFu::TcpOptions
- PacketFu::TcpReserved
- PacketFu::Timestamp
- PacketFu::UDPHeader
- PacketFu::UDPHeaderMixin
- PacketFu::UDPPacket
- PacketFu::Utils
- PacketFu::Write
- StructFu
- StructFu::Int
- StructFu::Int16
- StructFu::Int16be
- StructFu::Int16le
- StructFu::Int32
- StructFu::Int32be
- StructFu::Int32le
- StructFu::Int8
- StructFu::IntString
- StructFu::String
- Struct

No matching classes.

# PacketFu::PcapPackets

PcapPackets is a collection of PcapPacket objects.

### Attributes

endian[RW]

### Public Class Methods

new(args={}) click to toggle source

    # File lib/packetfu/pcap.rb, line 190
    def initialize(args={})
            @endian = args[:endian] || :little
    end

### Public Instance Methods

force_binary(str) click to toggle source

    # File lib/packetfu/pcap.rb, line 194
    def force_binary(str)
            str.force_encoding Encoding::BINARY if str.respond_to? :force_encoding
    end

read(str) click to toggle source

Reads a string to populate the object. Note, this read takes in the whole pcap file, since we need to see the magic to know what endianness we're dealing with.

    # File lib/packetfu/pcap.rb, line 201
    def read(str)
            force_binary(str)
            return self if str.nil?
            if str[0,4] == PcapHeader::MAGIC_BIG
                    @endian = :big
            elsif str[0,4] == PcapHeader::MAGIC_LITTLE
                    @endian = :little
            else
                    raise ArgumentError, "Unknown file format for #{self.class}"
            end
            body = str[24,str.size]
            while body.size > 16 # TODO: catch exceptions on malformed packets at end
                    p = PcapPacket.new(:endian => @endian)
                    p.read(body)
                    self<<p
                    body = body[p.sz,body.size]
            end
    self
    end

to_s() click to toggle source

    # File lib/packetfu/pcap.rb, line 221
    def to_s
            self.join
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.